Microsoft 365 is, for most businesses, where the most important things live: email, files and the team's conversations. It is also the first target for anyone trying to get in.
The good news is that almost all the protection you need is already included in your subscription. The bad news is that much of it is not turned on. These are the reviews that are most worth doing.
1. Multi-factor authentication for everyone
It is the single measure that stops the most attacks. With it, a stolen password is not enough to get in. It should be on for all users, with no exceptions for the owner or for shared accounts. Use an authenticator app instead of text messages when possible.
2. Separate administrator accounts
Nobody should read email or browse the web with an account that has global administrator permissions. The right approach is to have separate administrative accounts, used only for administration, and very few of them.
3. Block legacy sign-in methods
Older email protocols do not support multi-factor authentication, and attackers look for them precisely for that reason. If your organization still allows them, you have a back door open.
4. Watch for automatic email forwarding
One of the first things an attacker does after getting into a mailbox is create a rule that forwards copies of messages outside. Block automatic forwarding to external addresses and set an alert for when someone tries to create it.
5. Review how files are shared
In SharePoint and OneDrive it is easy to create links that anyone with the address can open. Review what type of link is created by default, limit anonymous links and set an expiration date on what is shared with outside people.
6. Protection against phishing and impersonation
Verify that anti-impersonation policies are configured, and that your domain has SPF, DKIM and DMARC records published correctly. These records keep others from sending email pretending to be your company, and help your own messages stay out of junk folders.
7. Independent backup
Microsoft protects its infrastructure, but information that is deleted, by mistake or with bad intent, can no longer be recovered after a certain time. For important email and files, a separate backup outside Microsoft 365 is worth having.
8. Accounts and licenses kept current
Every employee who leaves should lose access the same day. Periodically review active accounts, guest accounts and third-party applications with permission to read your organization's data. What nobody uses gets removed.
Where to start
If you can only do one thing this week, make it the first. If you can do three, add the second and the fourth.
The admin center includes a security score that compares your configuration with Microsoft's recommendations and tells you what is missing. It is not perfect, but it is a good starting point for a conversation with whoever manages your technology.
And a note on licensing: some protections, such as access rules based on device or location, depend on the plan you have. Before buying additional products, it is worth confirming what is included in what you already pay for.
← Back to the blog